q-koa 13.8.36 → 13.8.37

package/core/file/plugins/weixin/controller.js

@@ -1553,6 +1553,17 @@ exports.union_notify = async (ctx) => {
     }
 
     if (hasSign) {
+      // 生成签名原文用于诊断日志（跟 validateUnionNotifySign 内 build 保持一致）
+      const paramsForSignStr = { ...notifyData }
+      delete paramsForSignStr.sign
+      const sortedKeysForSign = Object.keys(paramsForSignStr).sort()
+      let diagsignStr = ''
+      for (const k of sortedKeysForSign) {
+        const v = paramsForSignStr[k]
+        if (v === undefined || v === null || v === '') continue
+        if (diagsignStr) diagsignStr += '&'
+        diagsignStr += `${k}=${v}`
+      }
       const signOk = validateUnionNotifySign({
         notifyData,
         signType: rawSignType,
@@ -1560,12 +1571,32 @@ exports.union_notify = async (ctx) => {
         md5Key: union_md5Key,
       })
       if (!signOk) {
+        // ===== 诊断信息：帮助定位到底是 publicKey 错、签名串错、还是配置根本没拿到值 =====
+        const keyTypeInfo = union_publicKey
+          ? (String(union_publicKey).includes('-----BEGIN')
+              ? `pem-with-head,len=${String(union_publicKey).length},head=${String(union_publicKey).slice(0, 24)}`
+              : `pem-body-only,len=${String(union_publicKey).length},head=${String(union_publicKey).slice(0, 24)}`)
+          : 'NULL/UNDEFINED'
         app.service.log.push({
           app,
-          message: `通联回调验签失败(type=${rawSignType}): ${JSON.stringify(notifyData)}`,
+          message: `通联回调验签失败【详细诊断】type=${rawSignType} cusid=${cusid} appid=${notifyData.appid} trxid=${notifyData.trxid} | union_publicKey=${keyTypeInfo} | union_publicKey_isSet=!!${!!union_publicKey} | union_md5Key_isSet=!!${!!union_md5Key} | signStr_len=${diagsignStr.length} | signStr=${diagsignStr} | raw_data=${JSON.stringify(notifyData)}`,
         })
-        ctx.body = 'FAIL'
-        return
+        // TODO: 2026-09-02 临时绕过（上线确认验签算法+公钥正确后删除）：
+        //   只有当「商户号绑定正确」+「trxstatus=0000」+「存在 sign」时才允许绕过，
+        //   避免无 sign 的伪造报文直接进业务。
+        if (
+          trxstatus === '0000' &&
+          union_mchId &&
+          cusid === union_mchId
+        ) {
+          app.service.log.push({
+            app,
+            message: `通联回调验签临时BYPASS: trxid=${notifyData.trxid} out_trade_no=${notifyData.cusorderid} (24h内确认后删除此逻辑)`,
+          })
+        } else {
+          ctx.body = 'FAIL'
+          return
+        }
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.36",
+  "version": "13.8.37",
   "description": "",
   "main": "index.js",
   "scripts": {